Flash Loan Attacks Reach Record High in DeFi, Wiping Out Millions

The DeFi space has been plagued by flash loan attacks in 2026, with several high-profile incidents resulting in significant losses. One such attack took place on August 27, 2026, when an attacker pumped the price of a governance token called MAMO by nearly eightfold, using it as collateral to borrow $8.7 million from Moonwell's Base lending markets.

The protocol's oracle simply believed the manipulated price, allowing the attacker to walk away with the borrowed funds without any smart contract bugs involved. This attack is just one example of the growing threat posed by flash loan exploits in DeFi.

Security firm TRM Labs reported on September 2, 2026, that price manipulation exploits tied to flash loans had hit a record high this year. The OWASP Smart Contract Security project has also started tracking the pattern under its own classification, SC04:2026.